The Interoperability of Financial Data (Job Market Paper)

Elif Cansu Akoguz, Tarik Roukny, Tamas Vadasz

This paper studies how data interoperability — third-party direct access to customers’ financial information — affects competition and welfare in the finance sector. Our model reveals a trade-off: while sharing customer data improves competition in information-intensive services like credit, it may increase prices of data-generating services like payments. We show that targeted data-sharing regimes (e.g., Open Banking) preserve the ability of banks to extract surplus by shifting market power from credit to payment markets. Although some firms benefit in aggregate from increased competition, others are left worse off by changes in prices. Wider-reaching data-sharing initiatives (e.g., Open Finance) further level the playing field and diminish banks’ capacity to monetize their data, reallocating surplus toward firms and alternative lenders. Our findings underscore the need to account for cross-market spillovers when designing policies that regulate access to financial data.

User privacy and cyber-security in platforms: Enforcement or self-regulation?

(Working paper on request) 

Elif Cansu Akoguz, Tarik Roukny

This paper examines the problem of cybersecurity moral hazard in digital platforms: firms choose how much to invest in protecting user data, but these efforts are costly and largely unobservable to users. As a result, they may underinvest or avoid storing user information altogether—an outcome that can reduce pricing efficiency and hurt welfare, especially in the presence of network effects. We study how regulation should address this problem and show that outcomes hinge on (i) whether the business is a traditional one (e.g. a retailer’s online shop) or a platform (e.g. e-commerce or payments), and (ii) the cost structure of the cybersecurity technology employed. In sectors where cyber-security is predominantly sustained by fixed-cost heavy technologies (e.g. tokenization, secure elements), eliminating moral hazard via standards or certifications generally raises welfare, and well-calibrated minimum-security mandates can improve it even further. In contrast, in sectors where marginal-cost heavy cyber-security technologies (e.g. homomorphic encryption, multi-party computation) prevail, eliminating moral hazard does not consistently improve welfare, and regulatory mandates can backfire by pushing firms toward privacy regimes that reduce user surplus. The key implication is that one-size-fits-all rules not optimal: while mandates can work in payments and e-commerce, they risk harming users in sectors like social media, healthcare, or crypto. Effective regulation must therefore be tailored and technology-aware to align cybersecurity practices with user welfare.